GStreamer gst-plugins-bad: Integer overflow in H.266/VVC parser (CVE-2026-119777)
An integer overflow vulnerability in GStreamer's gst-plugins-bad H.266/VVC parser can lead to stack-based buffer overflows and potential arbitrary code execution when processing malformed media.
CVE search metadata
CVE search record: CVE-2026-119777. Severity: high. CVSS: 7.8. KEV: no. Product: gst-plugins-bad. Brief: GStreamer gst-plugins-bad: Integer overflow in H.266/VVC parser (CVE-2026-119777). Brief link: https://feed.craftedsignal.io/briefs/2026-10-gstreamer-buffer-overflow/
Triage facts
Revision 1- Applicability
- gst-plugins-bad
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 19:36 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
A vulnerability exists in the GStreamer gst-plugins-bad component within the H.266/VVC parser (CVE-2026-119777). An integer overflow occurs when the parser processes the profile, tier, and level fields of a malformed H.266 media file or stream. This overflow results in a stack-based buffer overflow, which can lead to application crashes or arbitrary code execution in the context of the process handling the media.
Impact
Successful exploitation allows for an application crash (Denial of Service) or potential arbitrary code execution within the security context of the affected application process.
Recommendation
Inventory all applications utilizing the GStreamer framework and specifically the gst-plugins-bad component. Monitor official GStreamer project security advisories for patch availability and upgrade immediately upon release.
Immediate actions
Inventory systems and applications leveraging GStreamer and gst-plugins-bad
Threat Hunt
Identify applications invoking GStreamer binary modules
Data: Process command line and loaded module paths
Mitigations
Monitor GStreamer repository for patched releases of gst-plugins-bad
CVE-2026-119777